registry / @lydianpay/sdk-web / 3.7.1
@lydianpay/sdk-web@3.7.1
Drop-in crypto payment checkout for the web — a <lydian-checkout> web component and window.Lydian API across 20+ chains and major stablecoins.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged credential flow is scoped to a WalletLink session and its corresponding service. The manifest shows no install hook; its prepublishOnly script is a publish-time guard.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The wallet relay is initialized when the SDK subscribes to a wallet session.
Impact
This supports wallet session communication; no unrelated credential collection or transmission was identified.
Mechanism
The relay sends its session ID and key as Basic authorization to WalletLink event endpoints.
AI rationale
The flagged credential flow is scoped to a WalletLink session and its corresponding service. The manifest shows no install hook; its prepublishOnly script is a publish-time guard.
Network endpoints1
www.walletlink.org
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest points the package entry to dist/lydian.js and its only declared lifecycle script is prepublishOnly, a publish-time guard.
- The entry imports a bundled SDK chunk.
- The flagged Authorization value is built from a WalletLink session ID and key; the configured service URL is www.walletlink.org.
- The session authorization is used for WalletLink event requests, consistent with the wallet relay flow.
Evidence against
Behavioral surface
CryptoEnvironmentVarsNetworkWebSocket
HighEntropyStringsMinifiedTelemetryUrlStrings
Source & flagged code
4 flaggeddist/chunks/mountEngine-7GpOY00I.jsView file
7}
L8: const q8 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: gE
L625: ], O_ = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], N_ = ["accountsChanged", "chainChanged"], I_ = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "\\" + s.charCodeAt(0).toString(16) + " ";
L2322: }
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/chunks/mountEngine-7GpOY00I.jsView on unpkg · L77Trigger-reachable chain: manifest.main -> dist/lydian.js -> dist/chunks/index-BBPxP59-.js -> dist/chunks/mountEngine-7GpOY00I.js
L7: }
L8: const q8 = '*,:after,:before{--tw-border-spacing-x:0;--tw-border-spacing-y:0;--tw-translate-x:0;--tw-translate-y:0;--tw-rotate:0;--tw-skew-x:0;--tw-skew-y:0;--tw-scale-x:1;--tw-sca...
L9: <!-- One set of screen shells serves both flows. initializeComponents() stamps
...
L624: gE
L625: ], O_ = ["eth_sendTransaction", "personal_sign", "eth_signTypedData", "eth_sign"], N_ = ["accountsChanged", "chainChanged"], I_ = [
L626: "solana_signTransaction",
...
L763: payButtonsSlot: "#payButtonsSlot",
L764: closeDialogBody: "#modalCloseTransactionModal .modal-body",
L765: restoreDialogBody: "#modalRestoreDetails .modal-body"
...
L2320: function(s) {
L2321: return "
Findings
2 Critical2 High3 Medium5 Low
CriticalCredential Exfiltrationdist/chunks/mountEngine-7GpOY00I.js
CriticalTrigger Reachable Dangerous Capabilitydist/chunks/mountEngine-7GpOY00I.js
HighTrigger Reachable Credential Exfiltrationdist/chunks/mountEngine-7GpOY00I.js
HighSemantic Analysis Limiteddist/chunks/mountEngine-7GpOY00I.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @lydianpay/sdk-web@3.7.1.
See all versions of @lydianpay/sdk-web for other recorded verdicts.
- Review the evidence and your use of @lydianpay/sdk-web@3.7.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.